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The present invention relates to a network (GSM/GPRS) with 
functionality which is related to distribution or keys for 
authorisation, authentication and ciphering, subscriber 
information handling and CDR generation. 

Since GSM (Global System for Mobile communication) was 
introduced in the Nordic countries in 1992, penetration has 
reached as high as 40 % - and is still increasing rapidly. 
However, this also means that large investments have been S ' 
made in this system during those years. GSM is primarily' a 
system for speech communication, which makes up 98 % of the 
total traffic. Data services exist, but are slow, 
inefficient and expensive since they are run on circuit 
switched connections. 

In the year 2 000, GSM will be enhanced with a general 
packet data service (GPRS) , which uses the same radio access 
as GSM together with a new core network, based on IP. A 
maximum of about 150 kbps can be delivered, but the.. actual 
bandwidth will . be, : signif leant ly, lower . -due to the presence of 
other users and the quality of the radio connection, 
Databases and servers containing subscriber data, equipment 
data, short message handling, etc. already in operation for* 
the GSM:, sy st err, will- be reused for GPRS. ■ ;,,f 

Two years later, 'in 2002, UMTS (Universal Mobile ", 
Telecommunication ' System) will be taken into operation }■ 
delivering up to 2 Mbit/s over radio with full mobility-.: ' 

-Contrary to GPRS, 'the UMTS radio access network will be ; 

•built from scratch ;and existing core networks will bfe'"'. . 
modified and reused, to a' ; large extent,.. For the initial, phase 
of UMTS, the GPRS.Eind Ggfe" core networks are the most ' V : 
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interesting candidates because of their capabilities to 
handle mobile terminal and users. 

UMTS will support mixed services, which means everything 
from Internet access to multimedia conferencing. Judging 
5 from how fixed Internet' access presently' is booming, one is 
tempted to believe' that mobile Internet access will become 
equally popular. In addition, taking into account the 
development of IP telephony during the last" year and the 
fact that video standards like H. 323 [H-323] are being 
10 developed for IP networks, it is quite possible that an IP 
based* 'network is the 4 most future' proof ' solution for UMTS. 
When constructing public mobile 'networks , one has to keep in 
mind that radio resourced are" scarce and that these networks 
* are expensive to operate, and hence, it is necessary for the 
15 operator to have the means to' charge 1 the users for services 
that they use. In the near future/ it is doubtful that this 
requirement can be fulfilled by (Mobile) IP networks. 
Operators, who have large investments in GSM and GPRS 
systems, could, however, reuse parts of those to complement 
20 the shortcomings of IP networks. 

GSM and its future packet data service, GPRS, has an advanced 
system for 

• authorisation and authentication of users/ terminals , 
25 including key distribution 

• ciphering over radio, including key distribution 

• subscriber information handling 

• CD?, generation 

. through the VLR. functionality in the MSG and the SGSN. 
. 30, respectively and through the. • HLR and as well as other data 
bases. 
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: The GPRS backbone is, . however, not optimal because of its 
many successive protocol layers, which results, ; in long delays 
and large overhead. 

5 Th.e Internet, Protocol is simple, flexible and optimized for 
transporting data through networks. Enhanced with MobilelP 
for handling mobility, it could be used as a core network for 
mobile systems, i.e. the mobile user could get direct access 
.to the Internet _ without passing through an additional 

10 network, like GPRS backbone. However, IP lacks support for 
subscriber handling and charging. Authentication and 
encryption is supported , to ensure integrity and 
confidentiality but the key distribution, which is not 
standardized,^ is still a problem. The invention offers a 

15 solution of the security problem and form an efficient as 
well as secure core network for mobile users. 

The solution to the problem is described in the claims. 

20 UMTS is presently being standardardized and its core network 
will, in an initial phase, be based on the GPRS core network. 

Advantages to the invention is that is possibly to use the 
fixed network in a more efficient way, when the GPRS 
25 backbone, in a* later "stage is replaced by a purer IP network 
for transporting user data under the condition that the 
security issue's are solved. 



3 0- Embodiments" of the, invention, will nbw. be described, by way of 
•example,:- with' . reference .to >the accompanying ' drawings , in 
which: 
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Figure 1' The basic GSM architecture. 

Figure 2 Overview of' the GPRS logical structure 

Figure^ 3 'The GPRS Protocol architecture. The GPRS 
backbone is ' shaded " 

Figure 4. General UJ1TS Architecture with the reference 
points currently 'identified " in UMTS, Marchl998 
[UMTS23 . 01] . ^ 

Figure 5. Using IP for service transport end-to-end. 



Figure 6. Scenario wxtfi' Mobile IP support for intra 

UTRAN mobility and modified SGSN's to handle subscriber 
data etc . 

Figure 7. "Scenario witti Mobile IP supporting roaming in 
foreign networks. 

Figure 8. Evolution' scenario for UMTS. The IWU-Gb and 
IWU-Gbu "are taken fronT [units23 .20 ] 



; , i A glossary ' of the abbreviations used in this patent 

specification is set out belbw to facilitate an understanding 
of the present invention.' 

AN ' ' Access NetWork 

AUC Authentica€ion Center 

: * BSS' Base Sub System 

- GN ; : Core : Network' : 

" ' DHCP " Dynamic Hos r t : Control Protocol 
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ETSI 

GGSN. 
GPRS 
GTP._ 
GSM 

HA 
HLR 
SP 
IP 

MS 
MSC^ 
MT . , 
PLMN 
PSTN 
QoS 
SGSN 
SIM 
SP 
TCP 
UDP 
UE 
UMTS 



. European TTelecoimunication 
Standardisation Institute 
Gateway. GPRS Support Node v 
General Packet Radio Service 
GPRS Tunneling Protocol ...... 

Global System for. Mobile 

communication 

Home Agent 

. Home Location Register 
Service Provider 
Internet Protocol 
InterWorking Unit 
Mobile Station 

.Mobile Services Switching Center 

T Mobile Termination. ... 
Public Land Mobile Network 
Public Switched Telephone Network 
Quality of Service 
Service GPRS Support Node 
Subscriber Identity Module 
Service provider 



30 



Transport Control Protocol 
User Datagram Protocol 
User Equipment 

Universal : Mobile Telecommunications 
System 

UMTS Terrestrial Radio Access, . 
Network 

Visitor Location Register 

UMTS, the third generation ^cellular system currently being 
specified by ETSI., >: is., the , first cellular system to be 
optimized for extensive u : se ; .pf - data services mixed with 
speech. One .solution, is .to use the IP protocol for the 
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transport of services across core and access networks. Usxng 
a' MobilelP core network would allow roaming between the 
radid access networks- in a rather .straightforward: way. 
However, radio resources are ' scarce and public. cellular 
5 systems, are- expensive to operate, and hence,:,. it .is: of great 
■ importance that the users can be properly: charged:: for 

services- that they use. In the near future, it is doubtful 
- that this requirement can be fulfilled by (Mobile) <IP 
- - networks. Instead, parts of GSM/ GPRS could be reused to 
10 complement the functionality- of' ! IP networks:..- 

jri this description, a network' scenario is presented where 
the UMTS core network is based on Mobile IPv6, which, 
supports roaming and possibly also handover- between UTRAN . 
Since the GSM/GPRS system already has several key functions 
15 to handle mobile users, e.g. subscriber data, access 
control, keys for encryption, oyer radio, accounting 
information, the GPRS SGSN node should be .reused to handle 
the setup of lower layer communication, including 
authentication. and check of subscriber profile etc. A 
20 successful lower layer setup, should be required in order to 
obtain a MobilelP care-of address. The mechanisms for 
distributing authorization and encryption keys in GSM/GPRS 
can also be utilized for distributing keys for the IPsec 
protocol . 

■ 25 Examples, describing how MobilelP and part of the GPRS 

'core network could operate with a UMTS radio access network 
:T are presented later on in the description. The following 
' three sections will give a brief introduction to those parts 
of GSM, GPRS, UMTS and IP that are relevant for this study. 
3'0 ;: These are followed by a short discussion on using IP end- to - 
- l : ' ■ 7 end in mobile networks , before presenting the examples . 
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GSM ' 

•GSM is a. digital cellular system,; primarily- designed and 
used for speech, communication [gsm] .• A few, data, services and 
a rich: .feet of w. supplementary services : are^ standardized. The 
GSM n'etwork--ds':built ' up-, of ^BSS's (Ba.se Sub, System) , 
-MSC7VLR\s (Mobile. Services Switching .Center /Visitor Location 
Register) HLR's and -a few. other da.ta bases., and service 
node's, as illustrated in figure 1. . The 3SS contains base 
stations land. base .station^ controllers . Each terminal is 
equipped with .a .subscriber identity modules (SIM.) ., which is 
a smart ;card containing,^ among, .other .things, . the user 
identity.- , • . , } ... 

• The MSC. vis -.. the heart ,of :the, GSM system. It's duty is to: 
« ; per form : switchings .\ :>;•• r • .: l\ : 

• detect new mobile- terminals in its service: rkrea 
and p^rfor^ authentication -and authorization' 
procedures 'with these terminals * r ; - - 

• collect information about users from theii: HLR 
and store "the information in the VLR ~ 

• register location updates and store them* in the 

VLR " ■ 

• assist when handover . takes place between MSC's 

• create records for charging 

Frequently, the VLR. is integrated in the MSC. The Gateway - 
.MSC is., an MSC. with additional functionality to handle 
-traffic to and from the fixed network. For incoming traffic 

the G-MSC asks the HLR for routing information to the 

current MSC of the user. 

. The MSC communicates ,with databases like, the home location 
. register. (HLR) : and the . equipment identity register (EIR) via 
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an SS7 based signaling system called MAP (Mobile Application 
Party . 

The HLR stores the identity . and user data of all the 
subscribers belonging to. tbe-area ...,of ^he .related G-MSC . The 
.. 5 IMS I (International , Mobile - .Subscajib^r _ Number), , ... tlje phone 

number, service profile 1 ,etQ. are perraaiiently^stpred in the 
HLR. For routing of .incoming traffic the user's current VLR 
and forwarding, information . is, stored temporarily:. 
.Authentication and, ciphering keys, : which are .derived in the 
10 AUC (Authentication Center) are also, ava i 1 ab 1 e from the HLR. 
Authentication and authorization of the . terminal takes 
place each time, a connection is, setup, i.e. for each call. 
The authentication procedure is based, on the authentication 
algorithm, which is stored on the SIM card and in the AUC. 
15 The AUC picks a random number from which the algorithm 

creates the authentication key. The' random number and the 
key are then passed on to the HLR and the VLR, which sends 
the random number to the mobile - terminal . The SIM card uses 
the random number to produce the key, Which is returned to 
20 the network via the terminal . ; A comparisdh of the key 

received from the terminal arid the brie originating from the 
-AUC will 'tell if the terminal is the expected one. The same 
method is used for giving the' terminal the encryption key, 
but a different algorithm is used. This has the advantage 
25 that the encryption- key is nev^r sent; over radio where it 
could easily be. picked up by anyone . These algorithms are 
known nowhere outside the home network. Ori the terminal 
side, the algorithms are embedded in the SIM card and are 
available neither to the terminal nor t to the user. 
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\GPRS V • 7 .: ... • u f.i : 

GPRS (General Packet Radio Service) [GSM 03.60]" is a 
packet switched service Which, to "a large extent, is based 
ori' : a combination of ""GSM "Infrastructure, IP "technology and a 
■'~5- ^set of - hew 'functionality Figure ' 2 describes the overview of 
- - the * : GPRS* logical afehitectui*e The main ' advantage of GPRS is 
' that ' the Timi ted -'radio resource is used only when there is 

data to r transmit / There- 1 are '"-two kinds of -support nodes in 
' J the backbbne , - SGSN's (Service GPRS Support^ Node) and GGSN's 
10 ' k (Gatewky GPRS Support Node) J' : ? ; : ,: - 'i . ■<_.■.<.'_.. :> \ 

The main - f urictioris l of • the ; SGSN are to: 

• perform authentication and other procedures to- 
'let "new termihaXs connect to its* service area v 

• send/receive data packets to/from the GPRS 'mobile 
15 • keep record of the. mobile '.s location inside its 

service, area _ r . .... 

• route ; data packets, .frpm one GPRS operator to 
. another _ .> ......... . 

• produce .charging data records for, the, charging 
20 . • ..and : billing _ system . ' - , . . 

. . i ,The .S.GSN^co.itttnun.iS:ci.jc:esi .with -the HLR/ the 1 EIR,;.^the 
t SMS center etc.. via "a ; GPRS version^ of MAP.. ... 



" ' The main functions of the GGSN are to": y ' 

25 " • route "data packets from' one GPRS operator* to 
another 

• route mobile terminated data packets to 

appropriate SGSN where the mobile is currently 
located 

3 0 • act as a gateway between GPRS network and 

external data networks (IP, X.25, etc.) 
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.. handle de/ encapsulation of user- data protocol 
packets when communicating with external data, 
networks . 

•produce charging data records for i the, charging 
5 and . billing system . . ... - . ., : „. ■«,.•- .-. *., i it- v sr.arr 

GPRS, .Tunneling. Protocol , ,GTP [gprs09 : . 60 which is a 
. specif ic to GPRS , tunnels, user , data, packets be tween SGSN's 
" and,!cGSN':s. /This enabl.es th@,..net:wq-r^. -tpi -support, transmission 
10, of Several packet data, protocols, even. df-- the protocol is 
. not supported by a,ll SGSN',s GTP also, .transports signaling 
J data for mobility handling between the nodes.. As illustrated 
in figure 3 , GTP is placed on. top, of the. .transport IP and 
UDp layer in the protocol . stack.. By. using a non-standard 
15 protocol .to .transport user, da.f a, , it is probably, more 

difficult for users to do anything .harmful, to the -system. On 
' ' the other hand, it makes it impossible to use standard IP 
tunneling mechanisms without special solutions for GTP. An 
example is future resource reservation protocols, which are 
20 likely to operate in combination with standard IP-in-IP 
tunneling. : . . - '. ' "~ 



•"• UMTS . . • 

: ' The UMTS system, ; which ..c ; ,urr.ently is under, specification in 
25 ETSI, is based on a new. UMTS Terrestrial Radio Access 
' ' Network " (UTRAN) and existing, but evolved, .core networks 

(CN) such as IP, GSM/GPRS CN or ATM. t ; umts23 . 01] , The 
" ■ interworking units (IWU). adapt .the .different -CN'.s to the Iu 
: interface" if needed. The GRAN and the CN.' s may evolve 
30 independently of each other, while the IWU's follow the 

' evolution of CN's <m<l AN's to insure interconnection between 
- • ' these parts,' For flexibility; the user equipment consists of 
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different modules of which one is a UMTS version of the GSM 
SIM card, the USIM': "A' general view of the' logical modules 
and reference points is shown in figure 4. ' 

The UTRAN will probably have an' internal* mobility 
management system, which mean's J that ,"■ for" routing, the CN 
only needs to keep track of in which UTRAN the mobile 
■terminal is' located,' The CN : will have : to handle the 
: subscriber-- information" management , basic call 'handling, 
paging initiation';'' service feature ••analysis', ' security 
issues, , charging", etcv : Evolved versions of ' the ~GSM and GPRS 
-' r • ClJ ' & arg foreseen' 1 ' for : the' initial phase of UMTS " [ umtsi 3 .20] . 
■ Primarily-, 'the iWwill^ deal" with 'tr'anslatiori of protocol 
messages - an3 J hetWbrk ? parairieters," in those cases where the 
15 protocols in r the- CN" Snd' in the' UTRAN are different. If the 
'CN does 'not' support' 'functionality "required for a UMTS CN, 
~- the *'" lWu ' couia : contain"' 'irit ei 1 igence to enhance " the CN. The 
choice of protocols over the T Iii interface has not yet been 
made.' • -' : * ;ic! - ■'■•••' '•' - •■■>■■ *.■' - ■ . . 
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20. The- Internet Protocol- .. . ... , .... - • • 

The Internet Protocol, IP, is designed to route "IP packets 
across networks and network boundaries in a flexible and 
efficient way. Because of its popularity, many services have 
been developed to run on top of the IP protocol. Today, it 
25 is not unusual to implement virtual IP networks 'within other 
networks based ori' e .g'. ATtf or* IP, Which creates 'extra ' 
security, but also additional overhead and processing time. 
The GPRS backbone 'is one example of such a network. Taking 
- into account that UMTS" will" hot be introduced" until year 
3 0 2002, we "only consider IPv6 [ipv6] here." ' 

MobileiPv6 fmobip] is designed to deal with "macro" 
mobility management, i.e.. the movements of mobile nodes 
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between different IP subnets/ Routing in the Internet is 
based on fixed IP addresses, which depends on the subnet, 
' through which the; terminal is connected to the Internet . 
When .connected to a f ore ign< network, , the mobile node needs a 
temporary address using the prefix of .the ^ited,- network, a 
care-of address, to. be able to receive packets, r- 

Briefly;' MobileIPv6 works in the following way: 
' .When the mobile node arrives in a foreign 5 subnet , it 
' acquires a care-of address using the IPv6 address 

autocohf iguration . 
..The mobile node. registers its care-of address with a 
'' router in its home subnet which acts as the node's Home 
; ' Agent (HA) . The home agent uses proxy Neighbor Discovery 
to intercept the IPv6 packets ; addressed to the mobile 
5 ' node's home address. The packets are then tunneled to the 
mobile node's care-of address using IPv6 encapsulation. 
' This means that the mobile node can always be addressed 
r " by its home address, independently of which subnet it is 
roaming in . 

0. . ; ' ..When packets, which are tunneled from the home agent, 
..arrive at the mobile node, immediately sends a message, 
, which includes its current care-of address, to the- 
communicating node . After receiving such a packet, the 
communicating node will send packets directly to the 
5 care-of address. This way, MobilelpW inherently' supports 

; optimized routing, ' which minimizes the load on the home 

subnet. When changing care-of address, the mobile node 
sends its new care-of address to its home agent and all 
other nodes that it is communicating with. 
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Using, IP for Service Transport Across Different 
r. Networks 

■•■t. .1 Traditionally, telecom systems have been * developed with 
' • ■-■one kind of '''.transmission, ;\f or one ,:or >a -few., specific and well 
'S-^lsp'e^ by, the: -network. GSM is 

one example, of : 'these <*kind.;of systems rwhere. the tiine-to- 
market -for -new -services is, toovlong to.be. competitive. 

UMTS-, should support .mixed services, services provided by 
... thir.d-party , etc and new services must be easy and fast to 
10 implement. One possible solution is to use IP as a common 
format to deliver services end-to-end. This does not 
necessarily mean that the IP routing- mechanisms have to be 
utilized in all the different networks. For example, the 
, . UTRAN has to manage micro mobility, which includes frequent 
15^ and fast movements between base stations , which Mobile IP is 
not designed to handle. Instead, the IP layer could be 
provided a point-to-point connection between the IWU and the 
mobile terminal while the UTRAN handles the changing - 
connections underneath. 
2 0 The main advantages of this approach is that already 

today, an abundance of services and information is available 
on the Internet/ Having direct" Internet access from the 
mobile* terminal wouTd "facilitate" the" convergence of fixed 
and mobile networks " on a service level. 
25 In figure 5, the end-to-end IP layer is mapped onto the 

_ UMTS architecture. The IWU would provide interworking 

between the lower layers of the core network and the access 
network. 
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... GSM; '.IP arid Broadband R&dio Access ^ a , Mix that 
Matches :: . r---. . .. > ' •'-• " - 

As we have seen in previous sections, the UMTS UTRAN 
' together- with GSM /GPRS core networks would give us a system, 
■ 5 which 1 would handle- mobile user§ excellently and provide high 
' bandwidth connections : over- the radio interface. There is 

also "support for the operator- to ; profit from running such a 
" ; network: However, neither 'GSM ! n6r' GPRS are designed for 
large volumes and-the GPRS ' backbone is father inefficient 
10 due : : to the large overhead. 

Oh -the other hand, IP is. -simple^ and flexible for 
transporting data through networks 1 Enhanced with MobilelP, 
which optimized fbr' rbamififibetweeh- subnets, it is an 
interesting UMTS, core : network, .candidate. Unfortunately, it's 
15 support for subscriber handling and charging is poor. 

•Let us therefore study 'how'^the different-parts from IP, 
' GPRS and '-UMTS could interwOrk to support mobility. First, we 
■ .. will study- the case/ which -is --illustrated in figure 6, where 
20 the' terminal stays within its home IP network : 

• The mobile terminal arrives at a new UTRAN and listens 
to the radio broadcast messages, which contain 

" ' ■ information about radio parameters , network and cell 
identity, etc. as well as information about available 
25 ' core- networks , service providers , service capabilities 

' • - ''etc . " ' -' -' ' ' • ■ ' " •' ' 

• The mobile terminal sends a registration 
request including parameters such as identity, 

•desired service provider etc. 

30 • The UTRAN forwards' the" registration request to 

the SGSN," which processes it: 
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•i VThe SGSN contacts "the HLR< -of the mobile: terminal 
to collect data to perform an authentication 
procedure. 

Once . the . terminal is authenticated^ ^nd. found to be 
T: , ; ^allowed-,iri.,the present UTRAN, all ..information over 
^ the ;r:adio interface . can -be encrypted.. Encryption 

, vkeys are, obtained... from = the HLR. V A random number is 
sent.. ( to..,the fV mobile which can calculate, the key 
F .-. .. with an algprithm ^stored in the terminal. This 

way, the key is, not., sent oyer the ra.diq. interface. 

. ; >»\At .this > point , ... the terminal, also gets ^ 

r registered ^:in.; the UTRAN along with : locatidh 
; . , data -andi r^dip; -specific information-. 

• Now, the c terminal" can 'start cornmunicatihg 5 over the IP 
layer . : The ' terminal 'listens to 1 router advertisement 
messages and solicit the nearest DHCP server [dhcp] to 
^obtain -a:, configuration parameters . and .a -care-of- 

>. address ;.;.-lt; is assumed that , only • stateful; address 
l configuration will be used, since it gives; a? better 
^-support, for registration of the terminals than 
.stateless. Logically, we include the IP functionality 
in the SGSN and f call .the entire unit SGSN' and the HLR 
records include the care-of address of the mobile 
terminal 

V ; The -mobile terminal will then contact . its home : • 
agent to register its new care-of address 
according to standard MobilelP. 

• The ..-home agent t has ^tOv^accept. or reject the registration 
of a care-of . address . Before making a decision, the 
home agent could contact the HLR (via a new interface) 
to obtain information that this terminal is properly 
registered. In addition, the keys needed for using the 
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IPsec authentication header and/or the encapsulation 
' security payload [ipsec] could be obtained from the 
HLR. The mobile terminal can derive its keys from 
"information on its' US IM In the same way as in the GSM 
system. 

t . While, the terminal is connected and transmits data, 
charging data records are produced by the SGSN' . 
.Systems for billing and customer handling, already in 
operation for GSM, can easily be used also for UMTS. 



■In, figure 7, the, mobile - terminal, ;is roaming in a foreign 
network. The. procedure for registering in that network is 
very similar to the home network case, the only. difference 
being that the visited SGSN' contacts the HLR in the 
15 . .terminal's home network, either via the international SS7 
network or by tunneling the MAP protocol messages through 
..the; Internet. The mobile terminal . registers with the same 
home agent as before . . 

•20 ■ The, ETSI group SMG12 works with -UMTS architecture and 
.• •evolution, scenarios [umts23, 30] ... One idea for evolution is 
: . depicted in figure 8. The, most straightforward way to 

implement UMTS with an already- existing GPRS network is to 
-attach the UTRAN to the- Gb- interface via the IWU-Gb. 
;25 .However, if the. UTRAN will be. based on IP, a new IP based 
■interface, Gbu, should be opened up at, the SGSN, requiring 
an IWU-Gbu. In this description we have .gone one step 
further and transformed the SGSN into an IWU for a core 
network based directly on standard IP and MobilelP. 

30 
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. ,,. ,._UMTS,. the third generation cellular system which is 

v . - currently being specified by ETSX u is the first one to be 
optimized, for extensive use of data services mixed with 
• sp^ecli.. r One solution . is. ...to use the IP protocol for the 
5 transport of services across core and access networks. Using 
a Mobilel? core network would allow roaming between URAN's 
in'a rather straightforward way.' However/ "radio resources 
are scarce and public cellular systems -aire expensive to 
operate, and hence, it is of great importance that the users 
10 'can be properly charged for " the services they are using. In 
the near future, it is doubtful that this requirement can be 
' fulfilled by (Mobil e'flP networks. Instead, parts from 
' GSM/GPRS could -be' reused to complement the -functionality of 
IP 'netwbrks :" : "~ 1 ~" ■'<-*> ■ ■ • ■ _'- ■ ~' : <■ : ^ 

15 In this description, a network scenario is presented where 

the UMTS core network "is based on Mobile IPv6 , "which 
supports foaming and possibly also handover 'between UTRAN's. 
Since the GSM/GPftS system already has several key functions 
to handle mobile users, e.g. subscriber data;' access 
20 control, keys for encryption over radio, accounting 
* J ~ inf ormiatioh, : the- GPRS T: SGSN node should- be- reused to handle 
the setup- of lower 1 layer' communication, - including 
authentication' and- check of subscriber^ profile etc . A 
}: successful lower ' Ta'yer- setup should be required in order to 
25 : obtain a MobilelP* : care-of address . : > The mechanisms for 

distributing authorization arid encryption keys in GSM/ GPRS 
can also be r utilized 1 for -distributing keys for the IPsec 
' protocol. '"' ' " - ' - : " : - } ,; ' • 

3 0' • " • ' " ' ~ - • ' ' ' '■■ ' - 
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CLAIMS 



, , a network (GSM/GPRS) with functionality which is 

^ Vpvs for authorisation, 

XO handling «,» mobility to form an e«xcien 
secure core network for mobile users. I 

* network, as claimed in claim 1, characterised in 
that parts from GSM/GPRS-is reused complement the 
15 functionality of. IP networks. 

"i A network, as blaimed, >n claim 2. ^ t .r^ 

i;kt the GPRS is reused to. handle, the setup of lower 

• layer communication . '■ ,, 
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